A business most people never deal with directly
A data broker is a company whose main business is gathering personal information from many sources, combining it, and selling or licensing it to others. Unlike a shop or a social platform, a broker usually has no relationship with the people it describes. You may never have heard of the companies that hold records about you, and you did not sign up with them.
The industry is varied. Some brokers focus on marketing lists, some on identity verification, some on public-record searches, and some on risk or fraud signals. Many operate quietly, selling mainly to other businesses. Because the sector is fragmented and often opaque, reliable overall figures on its size are hard to come by, and this article makes no claims about them.
Where the information comes from
Brokers typically assemble data from several kinds of sources.
Public records. Depending on the place, these can include property records, court filings, professional licenses, business registrations and voter lists, though what is public and how it may be used differs widely.
Commercial sources. Retailers, subscription services, loyalty programs and surveys may share or sell customer data, subject to their own policies and applicable law.
Online activity. Advertising and analytics systems record browsing and app behavior, through online tracking techniques. Some of this feeds broker datasets, often through identifiers rather than names.
Other brokers. Data is frequently resold along a chain, which makes it harder to trace where a record originated.
Inference and modeling. Brokers may estimate characteristics, such as likely interests or income range, from other data. These estimates can be wrong.
Location data. Some data derived from mobile devices may be sold in aggregated or less aggregated form. Practices in this area have drawn particular scrutiny, and rules differ by place.
What gets packaged and sold
Products vary, but common categories include:
- Marketing lists and audience segments, such as groups with a stated interest or life stage.
- People-search and background records, which compile addresses, relatives and public filings.
- Identity verification and fraud tools, which check whether details given by a customer are consistent.
- Enrichment services, which add extra fields to a business’s existing customer records.
- Risk scores, which estimate the likelihood of some outcome. These are used in various contexts and can be controversial, particularly where they affect eligibility.
Customers include advertisers, retailers, lenders, insurers, employers, landlords, researchers, political organizations and, in some jurisdictions, public agencies. What each is permitted to do with the data depends on law and contract.
How trading works in practice
The process often looks like this in outline.
- Data is collected from many sources, in different formats.
- It is cleaned and matched, meaning different records are judged to describe the same person or household. Matching relies on names, addresses, email addresses, device identifiers and similar details.
- Matched records are merged into profiles or segments.
- The data is sold, licensed or made available through a service, sometimes in real time during online advertising.
- Buyers may add their own data and pass results on.
Because matching is imperfect, profiles can contain mistakes, mix up people with similar names or keep outdated details. The people affected often cannot see or correct them.
The matching step is also why the idea behind anonymized data matters: removing names may not stop records being linked if other identifiers remain.
Why it raises concerns
Lack of awareness and consent. Most people are not aware their data is being traded, and cannot easily say yes or no.
Accuracy. Errors can follow someone around, and it is not always possible to know which records are wrong.
Exposure. Aggregated profiles can include sensitive information, and people-search records can make it easier to locate or harass someone. Compiled data can also be useful to scammers, who may use personal details to make phishing scams more convincing.
Security. Large collections are attractive targets for breaches.
Fairness. Models fed with such data may reflect existing biases: algorithmic bias is a known concern.
Lack of oversight. Regulation is uneven, and enforcement is a continuing subject of debate.
Arguments made for the industry
Defenders point out that some uses are valuable. Identity checks can prevent fraud. Public-record compilation can serve journalists, researchers and legitimate background checks. Marketing data may let smaller businesses reach likely customers and can reduce irrelevant advertising. How much these benefits require the current level of data collection is disputed.
What laws and rules may offer
Some regions require brokers to register, to honor requests to see or delete data, or to let people opt out of sale. Others offer fewer rights. Rules also change, so the details are best checked with an official source in your area. Even where rights exist, exercising them can mean contacting many companies individually, and records may reappear later.
What individuals can do
These steps reduce exposure but are unlikely to erase it.
- Limit what you share to begin with, and avoid unnecessary forms, surveys and loyalty sign-ups.
- Check app and browser privacy controls, and limit advertising identifiers and location permissions.
- Use opt-out and deletion options where brokers provide them, recognizing that it can be a repetitive process.
- Consider separate email addresses for different purposes, which makes it harder to link activity.
- Be wary of unexpected messages that cite personal details; that does not prove they are legitimate.
- Monitor important accounts and use strong security habits.
Data brokerage is a reminder that personal data tends to travel beyond the place where it was first given. The most reliable protection is often to reduce how much goes out in the first place, and to support clearer rules about how what is already out there may be used.